WinDealer dealing on the side

LuoYu is a China-focused threat actor active since 2008, known for malware families SpyDealer, Demsty and WinDealer that target Windows, Linux, macOS and Android. A standout development is WinDealer’s man-on-the-side capability, delivered via several novel distribution methods, including abuse of legitimate update mechanisms. #LuoYu #WinDealer #SpyDealer #Demsty #TeamT5 #JSAC

Keypoints

LuoYu primarily targets targets located in China, including foreign diplomatic organizations, academia, and defense/logistics/telecommunications sectors.
Three malware families (SpyDealer, Demsty, WinDealer) are linked to LuoYu, with Demsty and WinDealer shown to be connected.
WinDealer is modular and decodes an embedded DLL from its resources using a 10-byte XOR key, enabling a broad set of capabilities.
Delivery methods include watering-hole infections and social engineering to spread fake app updates; a signed tool (qgametool.exe) was observed delivering WinDealer via a hardcoded update URL.
WinDealer’s capabilities cover extensive data collection, file operations, command execution, process discovery, Wi‑Fi network listing (in a variant), and persistence via the RUN registry key.
The attackers are described as employing a “man-on-the-side” infrastructure, using random IPs within specific Chinese networks and even non-existent domains to control and update WinDealer.

MITRE Techniques

[T1189] Drive-by Compromise – Watering hole infections and social engineering to push updates and malware. Quote: “…watering-hole attacks (for instance, on local news websites) to infect their targets.”
[T1218] Signed Binary Proxy Execution – WinDealer delivered through a signed executable (qgametool.exe) with a hardcoded update URL used to install/update malware. Quote: “…a signed executable qgametool.exe… This program contains a hardcoded URL that it uses to check for updates…”
[T1547.001] Registry Run Keys / Startup Folder – Persistence via the RUN key in the Windows Registry. Quote: “set up or remove persistence (via the registry’s RUN key)”
[T1027] Obfuscated/Compressed Files and Information – Embedded DLL is decoded with a 10-byte XOR key. Quote: “decode it using a 10-byte XOR key.”
[T1046] Network Service Scanning – Network discovery performed via ping scans. Quote: “Network discovery via ping scan.”
[T1082] System Information Discovery – Information gathering includes hardware details, network config, keyboard layout, running processes, and installed apps. Quote: “Information gathering: collecting hardware details, network configuration and/or keyboard layout, listing running processes, installed applications and configuration files of popular messaging applications (Skype, QQ, WeChat and Wangwang);”
[T1057] Process Discovery – Listing running processes. Quote: “listing running processes”
[T1572] Protocol Manipulation – Man-on-the-side capabilities imply intercepting and modifying in-transit data. Quote: “man-on-the-side attacker who is able to intercept all network traffic and even modify it if needed.”
[T1105] Ingress Tool Transfer – Downloading and uploading of arbitrary files as part of WinDealer operations. Quote: “Download and upload of arbitrary files;”

Indicators of Compromise

[File Name] WinDealer delivery files – qgametool.exe and other components referenced in distribution (example: PPTV(pplive)_forap_1084_9993.exe).
[MD5] ce65092fe9959cc0ee5a8408987e3cd4, 270902c6bb6844dc25ffaec801393245, 4e07a477039b37790f7a8e976024eb66, 26064e65a7e6ce620b0ff7b4951cf340
[SHA-1] 87635d7632568c98c0091d4a53680fd920096327, 78294dfc4874b54c870b8daf7c43cfb5d8c211d0, 158c7382c88e10ab0208c9a3c72d5f579b614947
[SHA-256] 27c51026b89c124a002589c24cd99a0c116afd73c4dc37f013791f757ced7b7e, db034aeb3c72b75d955c02458ba2991c99033ada444ebed4e2a1ed4c9326c400, 25cbfb26265889754ccc5598bf5f21885e50792ca0686e3ff3029b7dc4452f4d, 1e9fc7f32bd5522dd0222932eb9f1d8bd0a2e132c7b46cfcc622ad97831e6128, 318c431c56252f9421c755c281db7bd99dc1efa28c44a8d6db4708289725c318, 28df5c75a2f78120ff96d4a72a3c23cee97c9b46c96410cf591af38cb4aed0fa, b9f526eea625eec1ddab25a0fc9bd847f37c9189750499c446471b7a52204d5a, 08530e8280a93b8a1d51c20647e6be73795ef161e3b16e22e5e23d88ead4e226, 4a9b37ca2f90bfa90b0b8db8cc80fe01d154ba88e3bc25b00a7f8ff6c509a76f, 27c51026b89c124a002589c24cd99a0c116afd73c4dc37f013791f757ced7b7e, …
[URL] hxxp://download.pplive[.]com/PPTV(pplive)_forap_1084_9993.exe, http://www.microsoft.com/status/getsign.asp
[URL] https://securelist.com/windealer-dealing-on-the-side/105946/ (Source page)